Build date: 1783980002 - Mon Jul 13 22:00:02 UTC 2026
Build cvs date: 1783977765 - Mon Jul 13 21:22:45 UTC 2026
Build id: 2026-07-14.1
Build tags: amd64-regress ports sysupgrade

Applied the following diff(s):
/home/anton/tmp/robsd/src-sys-em.diff
/home/anton/tmp/robsd/src-sys-ptrace-revert.diff
/home/anton/tmp/robsd/src-sys-uhidev-sispm.diff
/home/anton/tmp/robsd/src-sysupgrade.diff

P lib/libcrypto/aes/asm/aes-586.pl
P regress/sys/kern/sysvmsg/msgtest.c
P regress/sys/kern/sysvsem/semtest.c
P regress/sys/kern/sysvshm/shmtest.c
P sbin/ifconfig/ifconfig.c
P sys/arch/octeon/include/octeonvar.h
P sys/arch/riscv64/stand/efiboot/conf.c
P sys/arch/riscv64/stand/efiboot/efiboot.c
P sys/crypto/cryptosoft.c
P sys/dev/pci/drm/drm_drv.c
P sys/dev/pci/drm/amd/amdgpu/amdgpu_drv.c
P sys/dev/pci/drm/include/drm/drm_drv.h
M sys/dev/usb/uhidev.c
P sys/kern/sysv_msg.c
P sys/kern/sysv_sem.c
P sys/net/if_veb.c
P usr.bin/tmux/cmd-break-pane.c
P usr.bin/tmux/cmd-join-pane.c
P usr.bin/tmux/cmd-split-window.c
P usr.bin/tmux/cmd-swap-pane.c
P usr.bin/tmux/cmd.c
P usr.bin/tmux/input.c
P usr.bin/tmux/key-bindings.c
P usr.bin/tmux/layout-set.c
P usr.bin/tmux/layout.c
P usr.bin/tmux/options-table.c
P usr.bin/tmux/prompt-history.c
P usr.bin/tmux/prompt.c
P usr.bin/tmux/resize.c
P usr.bin/tmux/server-client.c
P usr.bin/tmux/session.c
P usr.bin/tmux/spawn.c
P usr.bin/tmux/tmux.1
P usr.bin/tmux/tmux.h
P usr.bin/tmux/window-copy.c
P usr.bin/tmux/window-customize.c
P usr.bin/tmux/window.c
P usr.sbin/bgpd/rde.h
P usr.sbin/bgpd/rde_adjout.c
P usr.sbin/bgpd/rde_peer.c
P usr.sbin/bgpd/rde_update.c
M usr.sbin/bgpd/session.c
P usr.sbin/rpki-client/cert.c
P usr.sbin/smtpd/compress_gzip.c
P usr.sbin/smtpd/dns.c
P usr.sbin/smtpd/enqueue.c
P usr.sbin/smtpd/mda.c
P usr.sbin/smtpd/mda_mbox.c
P usr.sbin/smtpd/mta.c
P usr.sbin/smtpd/queue_backend.c
P usr.sbin/smtpd/spfwalk.c

commit IgDUdlt1ONEsIcWB
Author: nicm
Date: 2026/07/13 21:22:45

  Apply dragging change to scroll-down as well as scroll-up.

  usr.bin/tmux/window-copy.c

commit HjjZQ0ek2Fpolepd
Author: nicm
Date: 2026/07/13 20:02:00

  Add environment to customize mode also

  usr.bin/tmux/window-customize.c

commit yGdaPNrUIt3Km8kj
Author: nicm
Date: 2026/07/13 19:35:22

  Replace last use of fgetln with getline, GitHub issue 5389 from Yayo Razo.

  usr.bin/tmux/prompt-history.c

commit ejmjThOBwq72fTuM
Author: nicm
Date: 2026/07/13 19:32:28

  Add hooks to customize mode.

  usr.bin/tmux/options-table.c
  usr.bin/tmux/window-customize.c

commit 9zJNe7ElxW2pjQcu
Author: tb
Date: 2026/07/13 19:14:34

  correspondigly -> correspondingly

  lib/libcrypto/aes/asm/aes-586.pl

commit FLK1q6ocE2qNRMRm
Author: jca
Date: 2026/07/13 17:49:21

  Bump version after "Fix path to Banana Pi F3 dtb"

  sys/arch/riscv64/stand/efiboot/conf.c

commit M0DKCkt4s9zBTHHD
Author: jca
Date: 2026/07/13 17:48:19

  Fix path to Banana Pi F3 dtb

  From Miguel Landaeta, ok kettenis@

  sys/arch/riscv64/stand/efiboot/efiboot.c

commit AlDXvFrgbehm7XMD
Author: nicm
Date: 2026/07/13 16:30:28

  Add keys and menu items for copy mode line numbers, and a menu item for
  auto refresh.

  usr.bin/tmux/key-bindings.c
  usr.bin/tmux/tmux.1
  usr.bin/tmux/window-copy.c

commit dkTvqB0SJqn3Yv7O
Author: bluhm
Date: 2026/07/13 16:22:43

  Convert functions from K&R to ANSI style to avoid compiler warnings.

  regress/sys/kern/sysvmsg/msgtest.c
  regress/sys/kern/sysvsem/semtest.c
  regress/sys/kern/sysvshm/shmtest.c

commit tSx7razlxRRPtbWL
Author: nicm
Date: 2026/07/13 16:07:47

  Add new-pane -M to create a new pane from a mouse binding and bind to
  C-MouseDrag1Pane, removing the old ctrl-click-to-swap-pane binding.

  usr.bin/tmux/cmd-split-window.c
  usr.bin/tmux/key-bindings.c
  usr.bin/tmux/server-client.c
  usr.bin/tmux/tmux.1
  usr.bin/tmux/tmux.h

commit quCETlwi3OsM0W9E
Author: bluhm
Date: 2026/07/13 16:04:23

  Handle allocation failure and track correct mbuf length in IPComp.

  In swcr_compdec() m_copyback(M_NOWAIT) may fail, but the error is
  not checked.  The mbuf chain could be too short, but the expected
  length is returned as result.  Then ipcomp_input() will not set
  m->m_pkthdr.len to the actual length of the mbuf chain.  This only
  affects decompression, other cases do not need additional memory
  for enlarging.

  OK deraadt@

  sys/crypto/cryptosoft.c

commit NbNZymRH0U6xt6Uz
Author: cludwig
Date: 2026/07/13 15:17:47

  sysv_sema: Use better sleep addresses

  the sema array itself is used to derive wait channels. It may be re-
  allocated when resized. The old array gets lost and so do the wait
  channels. Thus waiters will never be woken up again. The sema array
  holds pointers. Use those as wait channels instead, the backing objects
  live long enough.

  ok mvs@

  sys/kern/sysv_sem.c

commit QJVOgWGf5G92PQgQ
Author: nicm
Date: 2026/07/13 15:03:03

  Add pane-activity event.

  usr.bin/tmux/input.c
  usr.bin/tmux/options-table.c
  usr.bin/tmux/server-client.c
  usr.bin/tmux/tmux.1
  usr.bin/tmux/tmux.h

commit tz1OrKkz6Tt99oag
Author: kirill
Date: 2026/07/13 13:41:25

  sys/cnmac: increase command buffer pool from 32 to 256 entries.

  With the current limit, two stalled output ports can exhaust this shared
  resource and eventually prevent all ports from transmitting packets.

  OK: visa@

  sys/arch/octeon/include/octeonvar.h

commit O7p1NoIQfJWiBDx2
Author: nicm
Date: 2026/07/13 13:01:14

  Add some additional simple events.

  usr.bin/tmux/cmd-break-pane.c
  usr.bin/tmux/cmd-join-pane.c
  usr.bin/tmux/cmd-swap-pane.c
  usr.bin/tmux/input.c
  usr.bin/tmux/options-table.c
  usr.bin/tmux/resize.c
  usr.bin/tmux/server-client.c
  usr.bin/tmux/session.c
  usr.bin/tmux/spawn.c
  usr.bin/tmux/tmux.1
  usr.bin/tmux/tmux.h
  usr.bin/tmux/window.c

commit H6lZ5C4zyW6tWYcO
Author: jsg
Date: 2026/07/13 12:53:56

  fix window_copy_mouse_in_selection() indentation; ok nicm@

  usr.bin/tmux/window-copy.c

commit yYvdBrcVdPr4o94A
Author: claudio
Date: 2026/07/13 12:27:34

  Remove adjout_prefix_free() and its use in adjout_prefix_unlink() instead
  use tombstones in the adjout array for empty/unlinked entries and collect
  them later via adjout_prefix_collect().

  adjout_prefix_first() and adjout_prefix_next() return direct pointers
  into the adjout prefix array and adjout_prefix_free() reshuffles entries
  so the pointers returned by first/next are no longer valid. By using
  tombstones the array pointers remain intact and it is possible to walk
  the array.

  Once done with the pt_entry adjout_prefix_collect() is called and it will
  collect all tombstones. Again after calling adjout_prefix_collect() any
  pointer into the adjout array is most probably invalid.

  While this solves the problem with prefix withdraw it does not solve
  addition of new entries. The good thing is that there is no code path
  that would require such an operation.

  On top of this the adjout_prefix_dump_r() has to walk all prefixes since
  that is what the callbacks expect. With the tombstones this is now safe.

  With and OK tb@

  usr.sbin/bgpd/rde.h
  usr.sbin/bgpd/rde_adjout.c
  usr.sbin/bgpd/rde_peer.c
  usr.sbin/bgpd/rde_update.c

commit MU4jD20UUBcEpYT5
Author: tb
Date: 2026/07/13 10:53:12

  rpki-client: simplify absence of SIA handling for BRK and RSC

  While RFC 6487, 4.8.8.2 clearly mandates the presence of the SIA extension
  for all EE certificates, there are two exceptions. BGPsec router keys are
  known to be special for no good rason, and they uphold this tradition and
  the EE cert of RSCs doesn't have a SIA since that makes sense for things
  that aren't distributed via the RPKI repository system.

  The logic allowing these special snowflakes is currently quite contorted.
  Simplify the comment to omit unnecesary fluff and implement the logic to
  match the comment precisely, also suppressing a duplicated warnx(). This
  does not really change anything but is much easier to follow.

  ok claudio

  usr.sbin/rpki-client/cert.c

commit m4S856YLaWqgAK6b
Author: nicm
Date: 2026/07/13 10:29:17

  Work out a single layout for the entire prompt so it can all be drawn
  together, fixes centered prompts. GitHub issue 5328.

  usr.bin/tmux/prompt.c
  usr.bin/tmux/tmux.h

commit gV3N4oD94vcgnKHV
Author: nicm
Date: 2026/07/13 10:22:52

  Allow drag on a selection to modify it, from Michael Grant.

  usr.bin/tmux/window-copy.c

commit OKy8AbP02vo1ZmT1
Author: nicm
Date: 2026/07/13 10:03:27

  Make split-window inside a floating pane work more nicely and not
  immediately create an overlapping pane, from Dane Jensen.

  usr.bin/tmux/cmd-join-pane.c
  usr.bin/tmux/cmd-split-window.c
  usr.bin/tmux/layout.c
  usr.bin/tmux/tmux.1
  usr.bin/tmux/tmux.h

commit vchfCj6HsKtZdGxa
Author: nicm
Date: 2026/07/13 09:42:12

  Set other cell when creating layout set, from Dane Jensen.

  usr.bin/tmux/layout-set.c

commit demJtYrNUjRp55N0
Author: nicm
Date: 2026/07/13 09:37:39

  Size comparison should be >= not >, from Yayo Razo.

  usr.bin/tmux/cmd.c

commit P7I1vnlAHW6sBFcQ
Author: jsg
Date: 2026/07/13 07:19:01

  more cleanup on close to avoid a use after free

  In Linux, some driver specific cleanup is handled with the release
  function pointer in struct file_operations.

  For amdgpu, this was changed in Linux 6.16 from drm_release() to
  amdgpu_drm_release().  Add a file_close function pointer to
  struct drm_driver so we can call a function that does the same cleanup.

  found by gnezdo@ with KASAN
  ok gnezdo@

  sys/dev/pci/drm/drm_drv.c
  sys/dev/pci/drm/amd/amdgpu/amdgpu_drv.c
  sys/dev/pci/drm/include/drm/drm_drv.h

commit aYj9MoWt3CbM0zsN
Author: jsg
Date: 2026/07/13 05:28:03

  return ENOMEM when mallocarray() fails in veb_rule_list_get()
  ok jan@ dlg@

  sys/net/if_veb.c

commit ePInh3mtGpw5Wj1q
Author: dlg
Date: 2026/07/13 01:08:59

  fix "ifconfig vebX -tagged ifX"

  it was wired up in the code to expect an extra argument, which isn't
  needed or expected as it is meant to clear all the tags on the
  interface.

  found by and fix identified by scott colby on bugs@
  thanks scott

  sbin/ifconfig/ifconfig.c

commit oanfoKrOeOxMqTcJ
Author: gilles
Date: 2026/07/12 23:32:39

  unlink the transformed temporary file on every commit failure

  queue_message_commit() left the .comp/.enc temporary behind on an ENOSPC
  rename failure and on the shared err path, so repeatedly triggering
  transform or out-of-space failures accumulated orphaned files.  unlink
  tmppath on all of those paths.

  from Andrew Griffiths, ok op@

  usr.sbin/smtpd/queue_backend.c

commit 3NoI08kh76dkRj9l
Author: gilles
Date: 2026/07/12 23:30:54

  reject empty or slash-bearing usernames before building the mbox path

  mda_mbox_init() builds _PATH_MAILDIR/username and creates and chowns it as
  root.  the username comes from K_USERINFO table data, which is not checked
  for slashes, so a dynamic userbase returning a slashed username could make
  root create a path outside the mailbox namespace. in practice, it does not
  affect default userbase which goes through getpwnam(), and it requires the
  admin to voluntarily create a badly crafted username in the userbase.

  from Andrew Griffiths (fixed by me), ok op@

  usr.sbin/smtpd/mda_mbox.c

commit w91V28Ha4ZyBzTQt
Author: gilles
Date: 2026/07/12 23:24:47

  reject CR and LF in argv-derived fields before starting the SMTP dialogue

  enqueue interpolates the sender, recipients and DSN options straight into
  MAIL FROM / RCPT TO command lines.  an embedded CR or LF split the command
  boundary and injected additional SMTP commands over the local session, so
  refuse any such field up front.

  from Andrew Griffiths (fixed by me), ok op@

  usr.sbin/smtpd/enqueue.c

commit ZfAqP4hoeoHsatRV
Author: gilles
Date: 2026/07/12 23:19:39

  free the copied envelope on the smarthost lookup failure path

  mta_on_smarthost() frees the malloc'd envelope on success, but the
  smarthost == NULL branch tempfailed the message and returned without
  freeing it, leaking a struct envelope per failed lookup.

  from Andrew Griffiths, ok op@

  usr.sbin/smtpd/mta.c

commit CZZ66B2bVfb7x5bc
Author: gilles
Date: 2026/07/12 23:18:36

  free mda_subaddress in mda_envelope_free()

  mda_envelope() duplicates the subaddress with xstrdup() when present but
  mda_envelope_free() never released it, leaking one bounded string per
  subaddressed local delivery.

  from Andrew Griffiths, ok op@

  usr.sbin/smtpd/mda.c

commit fg8haRjDHTEXSkxY
Author: gilles
Date: 2026/07/12 23:17:12

  use inflateEnd() to tear down the inflate stream in uncompress_gzip_chunk()

  the decompression path sets up the stream with inflateInit2() but the
  cleanup block called deflateEnd(), mismatching the zlib inflate/deflate
  APIs and leaking the stream state on every gzip queue read.

  from Andrew Griffiths, ok op@

  usr.sbin/smtpd/compress_gzip.c

commit QkDm6zrYA6GMNV9K
Author: gilles
Date: 2026/07/12 23:00:50

  stop parsing DNS answers once unpack_rr() reports failure

  the MX, MX-preference and spf walkers looped on the attacker-controlled
  ancount calling unpack_rr() without checking its return, processing stale
  or uninitialized rr contents on malformed or truncated replies.  break out
  of the loop as soon as unpack_rr() fails.

  from Andrew Griffiths, ok op@

  usr.sbin/smtpd/dns.c
  usr.sbin/smtpd/spfwalk.c

commit kfkkzkUxGCus6Uf4
Author: kirill
Date: 2026/07/12 22:06:01

  sysv: Recheck message queue limit after malloc

  que_create() allocates with M_WAIT and may sleep after sys_msgget()
  checks num_ques against msgmni. The kernel lock is released while the
  thread sleeps, allowing concurrent creators to pass the same check and
  exceed the queue limit.

  OK: mvs@

  sys/kern/sysv_msg.c

commit jOTQCxWLbFtjzzg4
Author: kirill
Date: 2026/07/12 22:05:32

  sysv: Use zero-based message queue indices

  que_ix starts at one, while KERN_SYSVIPC_MSG_INFO allocates msgmni
  entries and uses que_ix directly as an array index. The last permitted
  queue therefore makes sysctl_sysvmsg() copy one struct msqid_ds past the
  allocation, which KASAN detects.

  OK: mvs@

  sys/kern/sysv_msg.c